SB2026092272 - Multiple vulnerabilities in TeamPass

Description

This security bulletin contains information about 4 vulnerabilities.

1) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify folder contents in inaccessible personal or shared folder trees.

The vulnerability exists due to incorrect authorization in the copy_folder function when copying folders to an attacker-supplied destination folder. A remote user can specify an inaccessible destination folder to create folders and copy items into it.

Shared-folder exploitation requires that users can create folders or that the user has a role permitted to create folders.

2) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to move items without the required delete permission.

The vulnerability exists due to incorrect authorization in the PUT /api/v1/item/update endpoint when moving an item from its current folder. A remote user can send an item update request to move an item out of a folder for which they have no-delete rights.

3) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose restricted passwords.

The vulnerability exists due to incorrect authorization in the copy_folder function when copying folders containing per-item restricted items. A remote user can copy items that they are restricted from viewing and obtain readable unrestricted copies.

The copied items do not retain the original per-item user or role restrictions.

4) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify or move items without authorization.

The vulnerability exists due to improper authorization in the update_item function in app/sources/items.queries.php when processing item edit requests. A remote user can submit an item update request that specifies a destination folder where they have write access to modify or move items without authorization.

Exploitation requires access to the item's source folder and write access to the destination folder.

Remediation

Install update from vendor's website.

References

• https://github.com/nilsteampassnet/TeamPass/security/advisories/GHSA-q47m-rvr6-jqw7
• https://github.com/nilsteampassnet/TeamPass/security/advisories/GHSA-vxv5-cr34-5q7g